Re: ibus/CVE-2019-14822/glibc

[Brian May <bam@debian.org>]

Brian May <brian@linuxpenguins.xyz> writes:

> Apparently the fix for ibus creates a regression in glibc that must get
> fixed also:
>
> https://gitlab.gnome.org/GNOME/glib/merge_requests/1176
>
> However this patch patches GIO in glibc, and it looks like glibc in
> Jessie (2.19-18+deb8u10) doesn't have this directory. Or anything
> related to GIO that I can see.
>
> Hence, I am inclined to think maybe glibc doesn't need to be fixed in
> Jessie.

i have back-ported the patches to the Jessie version. Hopefully this is
correct :-)

https://gitlab.gnome.org/penguin_brian/glib/compare/2.42.1...fix_gio_auth

If I incorporate the test patch into the Debian package, expecting a
test failure, instead I get the following results:

SKIP: gdbus-server-auth 1 /gdbus/server-auth # SKIP Testing interop with libdbus not supported
SKIP: gdbus-server-auth 2 /gdbus/server-auth/tcp # SKIP Testing interop with libdbus not supported
SKIP: gdbus-server-auth 3 /gdbus/server-auth/anonymous # SKIP Testing interop with libdbus not supported
SKIP: gdbus-server-auth 4 /gdbus/server-auth/external # SKIP EXTERNAL authentication not implemented on this platform
SKIP: gdbus-server-auth 5 /gdbus/server-auth/sha1 # SKIP Testing interop with libdbus not supported
SKIP: gdbus-server-auth 6 /gdbus/server-auth/anonymous/tcp # SKIP Testing interop with libdbus not supported
SKIP: gdbus-server-auth 7 /gdbus/server-auth/sha1/tcp # SKIP Testing interop with libdbus not supported

This is something I would like to be able to test before uploading. At
least it does look like I enabled the test correctly.

Not sure when I will get to look at this again, I haven't claimed it, if
somebody else wants to take over then go ahead.
-- 
Brian May <bam@debian.org>